qaify-playwright-reporter 0.9.1 → 0.9.4

package/dist/fix.d.ts

@@ -136,12 +136,19 @@ export declare function fixContext(client: IngestClient, fixId: string, dir: str
  * Advisory dependensi tanpa AI: update paket di lockfile saja (tanpa install / script), cek ulang dengan audit, lalu
  * tulis hasilnya ke <dir>/.qaify/claude.json dalam bentuk keluaran `claude -p` (model qaify-deps, token 0) agar
  * fix-diff / fix-submit tidak berubah. npm: npm update dulu, npm audit fix bila paket masih rentan.
+ * Paket yang sudah aman di ujung branch (mis. ikut naik lewat PR temuan lain) tidak di-update: already_fixed.
  */
 export declare function fixDeps(dir: string, exec?: Exec): Promise<{
     fixed: boolean;
     summary: string;
     reason?: string;
+    already_fixed?: boolean;
 }>;
+/**
+ * Paket di composer.lock yang me-require pkg secara langsung. `--with-all-dependencies` hanya memperbarui dependensi
+ * pkg; tanpa ini dependennya tertinggal di versi lama yang belum tentu cocok dengan pkg baru.
+ */
+export declare function composerDependents(repo: string, pkg: string): Promise<string[]>;
 /** Masih ada advisory untuk paket ini? npm: hanya high / critical (sama dengan temuan audit-static). */
 export declare function stillVulnerable(output: string, manager: 'composer' | 'npm', pkg: string): boolean;
 /**
@@ -176,6 +183,8 @@ export interface ParsedFix {
     summary: string;
     reason: string | null;
     tests_run: string | null;
+    /** fix-deps: paket sudah aman sebelum di-update (bukan dari Claude, FIX_SCHEMA tidak memuatnya). */
+    already_fixed: boolean;
     usage: ClaudeUsage | null;
 }
 /** Output `claude -p --output-format json --json-schema FIX_SCHEMA`; null = tidak ada hasil terstruktur. */

package/dist/fix.js

@@ -191,6 +191,7 @@ export async function fixContext(client, fixId, dir, opts = {}) {
  * Advisory dependensi tanpa AI: update paket di lockfile saja (tanpa install / script), cek ulang dengan audit, lalu
  * tulis hasilnya ke <dir>/.qaify/claude.json dalam bentuk keluaran `claude -p` (model qaify-deps, token 0) agar
  * fix-diff / fix-submit tidak berubah. npm: npm update dulu, npm audit fix bila paket masih rentan.
+ * Paket yang sudah aman di ujung branch (mis. ikut naik lewat PR temuan lain) tidak di-update: already_fixed.
  */
 export async function fixDeps(dir, exec = defaultExec) {
     const started = Date.now();
@@ -202,18 +203,31 @@ export async function fixDeps(dir, exec = defaultExec) {
     const composer = target.manager === 'composer';
     const manifest = composer ? 'composer.json' : 'package.json';
     const auditCmd = composer ? 'composer audit --locked' : 'npm audit --package-lock-only';
+    const audit = () => composer
+        ? report('composer', ['audit', '--locked', '--format=json', '--no-interaction', `--working-dir=${repo}`])
+        : report('npm', ['audit', '--json', '--package-lock-only', '--prefix', repo]);
     const steps = [];
+    // tanpa cek ini update dependennya (mis. laravel/framework) tetap mengubah lockfile → PR yang tidak diperlukan
+    if (!stillVulnerable(await audit(), target.manager, pkg)) {
+        return writeDeps(dir, started, {
+            fixed: false,
+            already_fixed: true,
+            summary: `${pkg} sudah aman di branch ini.`,
+            reason: `${auditCmd} di ujung branch tidak lagi melaporkan advisory ${pkg} (kemungkinan ikut diperbarui lewat perubahan lain). Lockfile tidak diubah.`,
+        });
+    }
     let vulnerable;
     try {
         if (composer) {
-            steps.push(`composer update ${pkg} --with-all-dependencies --no-install`);
-            await exec('composer', ['update', pkg, '--with-all-dependencies', '--no-install', '--no-scripts', '--no-interaction', '--no-progress', `--working-dir=${repo}`]);
-            vulnerable = stillVulnerable(await report('composer', ['audit', '--locked', '--format=json', '--no-interaction', `--working-dir=${repo}`]), 'composer', pkg);
+            // paket yang me-require pkg ikut naik: mis. laravel/framework baru butuh laravel/sanctum yang mengenal perubahannya
+            const packages = [pkg, ...(await composerDependents(repo, pkg))];
+            steps.push(`composer update ${packages.join(' ')} --with-all-dependencies --no-install`);
+            await exec('composer', ['update', ...packages, '--with-all-dependencies', '--no-install', '--no-scripts', '--no-interaction', '--no-progress', `--working-dir=${repo}`]);
+            vulnerable = stillVulnerable(await audit(), 'composer', pkg);
         }
         else {
             steps.push(`npm update ${pkg} --package-lock-only`);
             await exec('npm', ['update', pkg, '--package-lock-only', '--no-fund', '--no-audit', '--prefix', repo]);
-            const audit = () => report('npm', ['audit', '--json', '--package-lock-only', '--prefix', repo]);
             vulnerable = stillVulnerable(await audit(), 'npm', pkg);
             if (vulnerable) {
                 steps.push('npm audit fix --package-lock-only');
@@ -244,6 +258,22 @@ export async function fixDeps(dir, exec = defaultExec) {
         tests_run: `${auditCmd}: ${pkg} bersih. Test aplikasi dijalankan CI repo pada PR ini.`,
     });
 }
+/**
+ * Paket di composer.lock yang me-require pkg secara langsung. `--with-all-dependencies` hanya memperbarui dependensi
+ * pkg; tanpa ini dependennya tertinggal di versi lama yang belum tentu cocok dengan pkg baru.
+ */
+export async function composerDependents(repo, pkg) {
+    let lock;
+    try {
+        lock = JSON.parse(await readFile(join(repo, 'composer.lock'), 'utf8'));
+    }
+    catch {
+        return [];
+    }
+    return [...(lock.packages ?? []), ...(lock['packages-dev'] ?? [])]
+        .filter((p) => p.name !== pkg && p.require && pkg in p.require)
+        .map((p) => p.name);
+}
 /** Masih ada advisory untuk paket ini? npm: hanya high / critical (sama dengan temuan audit-static). */
 export function stillVulnerable(output, manager, pkg) {
     const start = output.search(/[[{]/);
@@ -351,6 +381,7 @@ export function parseFixOutput(raw) {
         summary: out.summary,
         reason: typeof out.reason === 'string' && out.reason ? out.reason : null,
         tests_run: typeof out.tests_run === 'string' && out.tests_run ? out.tests_run : null,
+        already_fixed: out.already_fixed === true,
         usage: parseClaudeUsage(parsed),
     };
 }
@@ -381,6 +412,9 @@ export async function fixSubmit(client, fixId, claudeOutput, patch, workDir, opt
     const stats = patchStats(patch);
     const usage = parsed.usage ? { ...parsed.usage, files_changed: stats.files.length, lines_changed: stats.changedLines } : undefined;
     const summary = [parsed.summary, parsed.tests_run ? `Verifikasi: ${parsed.tests_run}` : null].filter(Boolean).join('\n\n');
+    // no_change + already_fixed: backend lama tetap menerimanya (gave_up), backend baru menutup temuannya
+    if (parsed.already_fixed)
+        return send({ status: 'no_change', already_fixed: true, summary, reason: parsed.reason ?? parsed.summary, usage });
     if (!parsed.fixed)
         return send({ status: 'failed', summary, reason: parsed.reason ?? parsed.summary, usage });
     if (!patch.trim())
@@ -435,7 +469,7 @@ export async function fixSubmit(client, fixId, claudeOutput, patch, workDir, opt
         step = 'di-commit';
         await git(['commit', '-q', '--no-verify', '-m', `fix(qaify): ${grant.title}`.slice(0, 200), '-m', parsed.summary], commitEnv);
         step = 'di-push';
-        await git(['push', '-q', '--no-verify', url, `HEAD:refs/heads/${grant.branch}`], auth);
+        await git(['push', '-q', '--no-verify', url, `${grant.force ? '+' : ''}HEAD:refs/heads/${grant.branch}`], auth);
     }
     catch (e) {
         await revokeTokens([grant.token], opts.fetch);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "qaify-playwright-reporter",
-  "version": "0.9.1",
+  "version": "0.9.4",
   "description": "Reporter Playwright untuk QA Factory (Qaify): kirim hasil test dan artefak ke /api/ingest, tanpa pernah menggagalkan test.",
   "license": "MIT",
   "author": "ahmdkenz",